Commitments that are enforced in code, not asserted in prose.

1. No claim of translation

The system has no lexicon and produces no sentences attributed to animals. Interpretations are categorical behavioural states with confidences. Every surface that displays a result also displays the not-a-translation statement, sourced from one place so it cannot drift between web, mobile and reports.

2. Uncertainty is reported, not hidden

Below a configurable threshold the answer is “insufficient evidence”, with an explanation and a concrete suggestion for what to record instead. Alternative interpretations are always shown, and the strongest confusable category is surfaced even when its raw score was low.

3. Evidence is inspectable

Every evidence line names a measurable signal, its modality, its weight and, where there is one, the measured value. A user can check the claim against their own recording. Contradicting signals are shown alongside supporting ones rather than suppressed.

4. Provider output is validated, not trusted

Any inference provider — built-in, remote, or a future foundation model — must return output matching the shared contract. Structural validation and coherence invariants both run before persistence. A malformed or incoherent result fails the job rather than reaching a user.

5. Guardrails are monotonic

Safety processing runs after interpretation and can only raise urgency, add guidance and add limitations. It can never make an output less cautious. A text scanner blocks generated advice that would encourage a prohibited action, and distinguishes advising an action from forbidding it.

6. Consent is explicit, granular and revocable

Research participation, model training, precise location and marketing are separate consents recorded in an append-only ledger with the policy version. Training eligibility requires both account-level and per-item consent and is recomputed from live records rather than cached.

7. Predictions are immutable and versioned

Feedback never overwrites a prediction. Re-analysis creates a new version that supersedes the old one, so what the system said and when is always recoverable — including after a model upgrade changes the answer.

8. Simulated output is labelled everywhere

Mock providers and seeded sample data are flagged at the database level, badged in the interface, marked in exports and stated in report caveats. A model version that produces simulated output cannot be promoted to production.

9. Privileged access is audited

Administrator access that bypasses normal ownership is recorded as an override, with the actor, the permission, the resource and the request id. Reads of protected medical notes are logged individually.

10. Risky features require a recorded safety review

Feature flags marked as safety-sensitive — the LLM narrative layer and community dataset sharing among them — cannot be enabled until a review is recorded against a named reviewer.